JavaScript “Access is Denied” error - no iframes

Question

We are seeing an intermittent JavaScript “Access is Denied” error in a customer application in IE8. The error occurs occasionally for some users and never for other users.

I am able to reliably reproduce the error on my browser by jumping through a few hoops:

• Go to the page in question (note the Internet zone, even though the web server is a test server running on our subnet)
• Open Internet Security Properties (message displayed that “some settings are managed by your system administrator”)
• Open Local Intranet
• Click Sites
• Click OK
• Click OK
• Note the zone has changed to Local intranet (even though I didn't make an changes)
• Click a dropdown on the page
• JavaScript error “type is null or not an object”

Debugging into that error shows it being thrown in Microsoft.Ajax.js in the “Sys.UI.DomEvent” function, and walking up the call stack shows that the root error occurs in “Sys.UI.DomEvent.addHandler” when it calls “Sys.UI.DomElement._getWindow(a).event” (a is of type DispHTMLWindow2) which throws an exception:

name: TypeError
description: “Access is denied.”
message: “Access is denied.”
number: -2147024891

Other users see the error without going into Internet Security Properties.

All the research I've done on “Access is denied” errors points to a problem using iframes from different sources, so I removed all the iframes from the page in question, but I still see the error.

What can cause a JavaScript “Access is denied” error in a page without any iframes?

Answer 1

Turns out that this occurs because something is causing the Internet Security Zone to switch occasionally while users are on a particular page that uses JavaScript extensively. When a page in IE changes security zone after it has been loaded, it is unable to execute JavaScript that accesses the parent window of the controls on the page.

Still not sure what is causing the page to change security zones, but this appears to only happen when we reference the site by IP, not host name (which always shows up as Local Intranet zone).